DNS Encryption: DNS over HTTPS (DoH) and DNS over TLS (DoT)

Every time you type a website address into your browser or click on a link, your computer performs a DNS (Domain Name System) lookup behind the scenes.

This lookup translates the human-readable domain name, like “websecuritylab.org”, into the actual IP address that computers use to identify and communicate with the website’s server.

What is DNS and How Does It Work?

When you visit https://websecuritylab.org the following happens:

While this DNS process is essential for internet browsing, traditional DNS lookups have a potential privacy and security caveat – they are typically sent over the internet in plaintext, unencrypted form.

This means that any entity monitoring your internet traffic, whether it’s your internet service provider, network admin, or even a malicious actor, can see what websites you are trying to access based on the DNS queries.

As online privacy and security concerns continue to grow, new protocols like DNS over HTTPS (DoH) and DNS over TLS (DoT) have emerged to address this issue.

DNS encryption aims to safeguard users’ browsing activities by shielding DNS lookups from potential eavesdroppers, including internet service providers (ISPs) and other third parties.

---

---

DNS Over HTTPS

DNS over HTTPS (DoH) encrypts DNS queries and responses using the HTTPS protocol, which is the same protocol used for secure web browsing.

It’s an alternative to the traditional DNS protocol (UDP/TCP), which transmits DNS queries and responses in plain text, making them vulnerable to eavesdropping and manipulation.

How DNS over HTTPS (DoH) Works

In DoH, DNS queries and responses are sent over HTTPS, just like regular web traffic.

The client, usually a web browser, sends encrypted DNS queries to a DoH-compatible recursive DNS resolver.

The resolver then decrypts the query, performs the DNS lookup, and sends the encrypted response back to the client over HTTPS.

The HTTPS protocol provides end-to-end encryption and authentication, protecting the privacy and integrity of the DNS communication.

DoH uses the same encryption and security mechanisms as HTTPS, such as TLS/SSL and certificate-based authentication.

DNS Over TLS

DNS over TLS (DoT) is a protocol that encrypts DNS queries and responses using the Transport Layer Security (TLS) protocol.

Like DoH, DoT aims to enhance the privacy and security of DNS communications by preventing eavesdropping and tampering with DNS traffic.

How DNS over TLS (DoT) Works

In DoT, DNS queries and responses are sent over an encrypted TLS session between the client and a DoT-compatible recursive DNS resolver.

The client initiates a TLS handshake with the resolver, and once the TLS session is established, all subsequent DNS queries and responses are encrypted and transmitted over this secure channel.

The TLS protocol provides end-to-end encryption and authentication, ensuring the confidentiality and integrity of the DNS communication.

DoT typically uses TCP as the underlying transport protocol but also supports UDP.

Benefits of DNS Encryption

1. Improved Privacy: DoH and DoT encrypt DNS queries and responses, preventing eavesdropping.
2. Enhanced Security: DoH and DoT ensure the integrity of DNS communications and prevent tampering or manipulation of DNS responses.
3. Censorship circumvention: They can help bypass DNS-based censorship or content filtering.

Potential Drawbacks and Challenges of DNS Encryption

1. Centralisation: DNS encryption requires users to trust specific DoH/DoT-compatible recursive DNS resolvers, which could lead to centralisation of DNS resolution and potential censorship or surveillance by the resolver operator.
2. Content Filtering: Some organisations, such as enterprises or schools, may find it challenging to implement content filtering or parental controls when DNS queries are encrypted and bypass their local DNS servers.
3. Compatibility Issues: DoH and DoT require client and server support, which may lead to compatibility issues with legacy systems or network configurations that are not compatible.
4. Increased Overhead: DNS encryption adds overhead, which may result in slightly higher latency than traditional DNS, especially for initial connections or when connection reuse is not possible.
5. Firewall and Network Configuration: DoT may require additional firewall and network configuration changes to allow DoT traffic, which can be challenging in some environments, especially those with strict security policies.
6. It Might Not Provide Complete Privacy: Your ISP/network administrator might not be able to see what URL you’re trying to reach, but they can still perform reverse DNS lookups. While reverse DNS lookup is not as easy as it used to be due to the explosion of content delivery networks (CDN) like Cloudflare, it is still very much possible. They can also exploit vulnerabilities in the Server Name Indication (SNI) extension of the TLS protocol. The Server Name Indication (SNI) is a field in the TLS handshake that contains the hostname to which the client wants to connect. This allows the server to present the correct SSL/TLS certificate for that domain. However, the SNI field is sent in plaintext during the initial TLS handshake before the encrypted connection is established. This means that even though the actual content is encrypted with HTTPS, an ISP or other observer can still see the hostname (it is mostly domain name) you are trying to access by inspecting the SNI value. Recently, we have seen a rise in the use of ESNI to mitigate this vulnerability.

Similarities and Differences between DNS over HTTPS and DNS over TLS

	DNS over HTTPS	DNS over TLS
Encryption Protocol	DoH uses the HTTPS protocol (HTTP over TLS/SSL) to encrypt DNS traffic.	DoT uses the TLS protocol directly.
Transport Protocol	DoH typically uses TCP as the underlying transport protocol.	DoT can use either TCP or UDP.
Port Numbers	443	853

Performance Considerations

Latency and Overhead

Caching and Connection Reuse

Network and Firewall Considerations

Setting Up DNS Encryption Using Cloudflare

Cloudflare’s 1.1.1.1 recursive DNS resolver supports DNS over TLS (DoT) and DNS over HTTPS (DoH).

The documentation on how to set it up can be found here.